Veracode Research Reveals Government Applications at Heightened Risk of Cyber Attack: 59% Have Flaws Left Unfixed for More than a Year
Veracode, a global leader in application risk management, today released research revealing applications developed by public sector organizations have more security debt than those created by the private sector. Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 59 percent of applications in the public sector, compared to the overall rate of 42 percent. The research analyzed public sector organizations in more than 25 countries across the globe.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240529282258/en/
Figure 2: Security Debt in Public Sector Applications (Graphic: Business Wire)
“Decades of accumulated security debt in unpatched software and poor security configurations, are in the applications that serve our government,” said Chris Eng, Chief Research Officer at Veracode. “Without a systematic and continuous approach to finding and fixing security flaws, the public sector is left dangerously exposed to attacks from hackers.”
Federal government systems are increasingly under cyberattack, as malicious criminals target public sector organizations with more damaging and disruptive techniques. In response, the federal government is enforcing a flurry of initiatives to strengthen cybersecurity, including efforts to reduce risk in the applications that serve the government. In March of 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) released the Secure Software Development Attestation Form to hold providers to the federal government accountable for insecure software.
Veracode researchers found that while slightly fewer public sector organizations (68 percent) have security debt than other industries (71 percent), they tend to accumulate more of it. Only three percent of applications are flaw-free, compared to six percent across other industries. Even more concerning, 40 percent of public sector entities have persistent, high-severity flaws that constitute ‘critical’ security debt, which would put the confidentiality, integrity, and availability of businesses at serious risk if exploited.
“The good news is that most organizations have the capacity to remediate all critical debt, but risk prioritization is key,” said Eng. “Two-thirds of all flaws in public sector organizations are either less than one year old or are not critical in severity. In addition, less than one percent of all flaws constitute critical security debt. By prioritizing that security debt with focused effort, organizations can achieve maximum risk reduction and then move to address non-critical flaws based on their risk tolerance and capabilities.”
According to the report, security debt in the public sector primarily affects first-party code (93 percent), but most of the critical security debt comes from third-party dependencies (55.5 percent). This reinforces the importance of the Open Source Security Software Initiative (OS3I), an inter-agency working group focused on ensuring open-source software is “as safe, secure and sustainable as it is open.” It also emphasizes the need for organizations to focus on both first- and third-party code to effectively reduce security debt.
The analysis further shows security debt in the public sector is primarily concentrated in older, larger applications (22 percent). This is especially true for critical security debt (30 percent), confirming a correlation between application age and the accumulation of security debt. Researchers also compared the security debt profile for different development languages and found that Java and .NET applications stand out as significant sources of debt in the public sector.
“The current state of software security in the public sector reinforces the importance of making secure by design a standard approach for the whole network connected world,” closed Eng. “We applaud CISA’s recent announcement of its Secure by Design Pledge and are proud to be one of the inaugural signatories. Our goal with this research is to further support our government and industry partners in promoting widespread adoption of these principles.”
The full State of Software Security Public Sector 2024 report is available to download on the Veracode website.
About the State of Software Security Report
The Veracode State of Software Security 2024 report analyzed data from large and small companies, commercial software suppliers, software outsourcers, and open-source projects. The research draws from more than a million (1,007,133) applications across all scan types, 1,553,022 dynamic analysis scans, and 11,429,365 static analysis scans. All those scans produced 96 million raw static findings, 4 million raw dynamic findings, and 12.2 million raw software composition analysis findings.
About Veracode
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, and Penetration Testing.
Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.
Copyright © 2024 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
View source version on businesswire.com: https://www.businesswire.com/news/home/20240529282258/en/
Contact information
For more information, please contact:
Katy Gwilliam
kgwilliam@veracode.com
About Business Wire
For more than 50 years, Business Wire has been the global leader in press release distribution and regulatory disclosure.
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
Daiichi Sankyo Shines a Light on Inequalities and Unmet Needs in Care as Part of Its Commitment to People With Cardiovascular Disease31.8.2024 18:00:00 EEST | Press release
Daiichi Sankyo Europe, (hereafter, Daiichi Sankyo) today announced its reinforced commitment to addressing key unmet needs and barriers in cardiovascular (CV) care, by shining a light on inequalities in treatment and outcomes experienced by various patient groups. The announcement follows the presentation of data from sub-analyses of the SANTORINI observational study and ETNA-AF (Edoxaban Treatment in routiNe clinical prActice in patients with nonvalvular Atrial Fibrillation) study programme, at the European Society of Cardiology (ESC) Congress 2024. Gender inequalities in CV disease treatment and LDL-C goal attainment Raised low-density lipoprotein cholesterol (LDL-C) is a key modifiable contributor to risk of cardiovascular major events. It has been shown that for every 1 mmol/L reduction in LDL-C, there is a 22% reduction in major cardiovascular events after 1 year.7,8 Female patients in Europe who are at high or very high CV risk were undertreated and less achieved guideline-recomm
Suzano completes purchase of 15% stake in Lenzing AG31.8.2024 01:40:00 EEST | Press release
Suzano, the world's largest pulp producer, today announces the completion of its acquisition of a 15% stake in Lenzing AG, the Vienna-listed leading global supplier of sustainable premium cellulosic fibres for the textile and non-wovens industry, from B&C Group. As announced in June this year, the transaction value is EUR 230 million (or EUR 39.70 per share). The agreement was subject to regulatory approval, which was granted without restrictions. The long-term partnership between Suzano and B&C Group establishes that Suzano has the right to hold two seats on Lenzing’s Board and the option to acquire an additional 15% stake from B&C Group until the end of 2028. Following the sale of the 15% stake, B&C Group now holds 37.25% of Lenzing’s share capital. Lenzing is a leading global supplier of premium wood-based cellulosic fibers (lyocell, modal, and viscose) for the production of clothing, home textiles, hygiene products, and non-woven materials. Beto Abreu, CEO of Suzano, said: “Lenzing
Ant International Collaborates with Brazilian Partners to Drive Financial Inclusion with Innovative Credit Tech Solutions30.8.2024 21:46:00 EEST | Press release
Ant International, a digital payment and financial technology leader, today announced its strategic initiative to provide AI-driven credit technology solutions designed to empower local partners and advance financial inclusions in Brazil. As a major milestone, Ant International has formed a strategic partnership with Dock, a leader in payments and banking technology in Latin America. This collaboration aims to enhance the credit management capability and infrastructure efficiency for Dock’s clients, which include financial institutions, retailers, fintech start-ups, etc. The shared vision is to make credit services more inclusive for market segments that are currently insufficiently served, such as micro, small and medium-sized enterprises (MSMEs). In the initial phase of the collaboration, Ant International’s AI-driven credit tech solutions, including an automated and intelligent risk management engine, will be explored for integration into Dock One platform. This initiative aims to s
Wipro Appoints Srikumar Rao as Global Head of Its Engineering Edge Business Line30.8.2024 17:20:00 EEST | Press release
Wipro Limited (NYSE: WIT, BSE: 507685, NSE: WIPRO), a leading technology services and consulting company, today announced the appointment of Srikumar Rao as Global Head of its Engineering Edge Business Line, effective from October 5, 2024. Srikumar succeeds Harmeet Chauhan, who is stepping down to pursue opportunities outside the organization. Srikumar will report to Srini Pallia. Srikumar has been with Wipro for 26 years and has grown with the organization, serving in various leadership roles. He was most recently the Chief Operating Officer (COO) of Wipro Engineering Edge (WEE) and Global Practice Head of Embedded Systems. His work has spanned several markets, selling and delivering specialized Engineering, Research, and Development (ER&D) services to Software & Internet, Semiconductor, Automotive, Manufacturing, and Communications clients. In his new role, Srikumar will continue to scale and strengthen Wipro’s engineering prowess. He will also be responsible for defining the vision
Alnylam Presents Detailed Results from the Positive HELIOS-B Phase 3 Study of Vutrisiran▼ in Patients with ATTR Amyloidosis with Cardiomyopathy at the European Society of Cardiology Congress30.8.2024 13:00:00 EEST | Press release
Alnylam Pharmaceuticals, Inc. (Nasdaq: ALNY), the leading RNAi therapeutics company, today announced detailed results from the HELIOS-B Phase 3 study of vutrisiran, an investigational RNAi therapeutic in development for the treatment of ATTR amyloidosis with cardiomyopathy (ATTR-CM). The data were presented today in a Hot Line session at the European Society of Cardiology (ESC) Congress 2024, taking place August 30-September 2 in London, United Kingdom. Results from the HELIOS-B study were also simultaneously published in TheNew England Journal of Medicine. As previously reported, the HELIOS-B study met all 10 of its primary and secondary endpoints, across both the overall and monotherapy populations, with statistical significance. Enrolled patients were predominantly New York Heart Association (NYHA) Class I or II with wild-type disease and had been diagnosed by non-invasive methods, with substantial concurrent treatment with available standard of care treatments such as tafamidis and
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom